private void watcher_EventArrived(object sender, EventArrivedEventArgs e)
        {
            string eventType = e.NewEvent.ClassPath.ClassName;
            WMI.Win32.Process proc = new WMI.Win32.Process(e.NewEvent["TargetInstance"] as ManagementBaseObject);

            switch (eventType)
            {
                case "__InstanceCreationEvent":
                    if (ProcessCreated != null)
                    {
                        ProcessCreated(proc);
                    }
                    break;

                case "__InstanceDeletionEvent":
                    if (ProcessDeleted != null)
                    {
                        ProcessDeleted(proc);
                    }
                    break;

                case "__InstanceModificationEvent":
                    if (ProcessModified != null)
                    {
                        ProcessModified(proc);
                    }
                    break;
            }
        }

        private void WatcherOnEventArrived(object sender, EventArrivedEventArgs eventArrivedEventArgs)
        {
            Console.WriteLine("Event arrived");

            CheckKeyboardPlugging();
            SetzeNumLock();
        }

 static void DeviceRemovedEvent(object sender, EventArrivedEventArgs e)
 {
     ManagementBaseObject instance = (ManagementBaseObject)e.NewEvent["TargetInstance"];
     Console.Write("Remove - ");
     var tmpQuery = new ManagementObjectSearcher("select Description,Name from Win32_LogicalDisk").Get();
     var currDrives = new List<string>();
     foreach (var drive in tmpQuery)
     {
         if (drive["Description"].ToString().Contains("Removable"))
         {
             currDrives.Add(drive["Name"].ToString());
         }
     }
     for (int i = 0; i < drives.Count; i++)
     {
         if (currDrives.IndexOf(drives[i]) == -1)
         {
             Console.WriteLine(drives[i]);
             //drives.RemoveAt(i);
             drives.Clear();
             drives.AddRange(currDrives);
             break;
         }
     }
 }

 void OnRegistryWatcher_EventArrived(object sender, EventArrivedEventArgs e)
 {
     if (this.RegistryKeyChanged != null)
     {
         this.RegistryKeyChanged(this, new RegistryKeyChangedEventArgs(e.NewEvent));
     }
 }

 private void ProcessStartEventArrived(object sender, EventArrivedEventArgs e)
 {
     var processName = e.NewEvent.Properties["ProcessName"].Value.ToString();
     if (processName.ToLowerInvariant() == this.processName.ToLowerInvariant())
     {
         //var timeCreated = (ulong)e.NewEvent.Properties["TIME_CREATED"].Value;
         this.notifyAction(DateTime.Now);
     }
 }

 void DeviceArrived(object sender, EventArrivedEventArgs e)
 {
     List<Descriptor> arrivedDevices =
         Enumerator.AllDevices.Except(Devices).ToList();
     if (arrivedDevices.Count > 0)
         App.Invoke(() => Devices.AddRange(arrivedDevices));
 }

 static void HandleEvent(object sender, 
     EventArrivedEventArgs e)
 {
     ManagementBaseObject targetInstance =
         (ManagementBaseObject)e.NewEvent["TargetInstance"];
     Console.WriteLine(targetInstance["Name"]);
 }

        private void HandleProcessDeletion(object sender, EventArrivedEventArgs e)
        {
            //Console.WriteLine("Event arrived !");
            CLogger.WriteLog(ELogLevel.DEBUG, "Process killed arrived: # " + count++);
            try
            {
                // Get the Event object
                Win32ProcessInfo newInfo = new Win32ProcessInfo();
                newInfo.processID = Convert.ToInt32(e.NewEvent.Properties["ProcessId"].Value.ToString());
                newInfo.timeStamp = DateTime.Now;

                //CLogger.WriteLog(ELogLevel.DEBUG, managementObject.GetText(TextFormat.Mof));
                //MessageBox.Show("Here");
                //Win32ProcessInfo newInfo = processProcDeleteObject(managementObject);

                lock (killedProcessList)
                {
                    killedProcessList.Add(newInfo);
                }
            }
            catch (Exception ex)
            {
                //throw (new System.Exception(ex.Message));
                CLogger.WriteLog(ELogLevel.ERROR, ex.Message + "\n" + ex.StackTrace);
            }
        }

        private void OnProcessStarted(object sender, EventArrivedEventArgs e)
        {
            try
                {
                    uint processId = (uint)(e.NewEvent["TargetInstance"] as ManagementBaseObject).GetPropertyValue("ProcessId");
                    string eventType = e.NewEvent.ClassPath.ClassName;

                    ProcessEventArgs args = new ProcessEventArgs(Process.GetProcessById((int)processId));
                    EventHandler<ProcessEventArgs> handler;

                    switch (eventType)
                    {
                        case "__InstanceCreationEvent":
                            handler = this.ProcessStarted;
                            if (handler != null)
                                this.ProcessStarted(this, args);
                            break;

                        case "__InstanceDeletionEvent":
                            break;

                        case "__InstanceModificationEvent":
                            break;

                        default:
                            break;
                    }
                }
                catch (Exception ex)
                {
                    Debug.WriteLine(ex.ToString());
                }
        }

 private void ReportEventMessage(EventArrivedEventArgs e)
 {
     ManagementBaseObject o = e.NewEvent; //__InstanceCreationEvent
     ManagementBaseObject mo = (ManagementBaseObject)o["TargetInstance"];//Win32_Process
     Console.WriteLine("Name={0},ExecPath={1},CommandLine={2}",
         mo["Name"], mo["ExecutablePath"], mo["CommandLine"]);
 }

 private static void OnFolderChanged(object source, EventArrivedEventArgs e)
 {
     using (StreamWriter F = new StreamWriter("C:\\LABA4\\Laba-4.log", true))
     {
         F.WriteLine(DateTime.Now + " C:\\LABA4\\TEST changed");
     }
 }

 private static void OnRegChanged(object source, EventArrivedEventArgs e)
 {
     using (StreamWriter F = new StreamWriter("C:\\LABA4\\Laba-4.log", true))
     {
         F.WriteLine(DateTime.Now + " HKEY_LOCAL_MACHINE\\Software\\LABA4 changed");
     }
 }

        private void HandleEvent(object sender, EventArrivedEventArgs e)
        {
            ManagementBaseObject info = e.NewEvent;

            log.Info("Event arrived ! " + info.ClassPath);
            log.Debug(info.GetText(TextFormat.Mof));
        }

 private static void OnDNSCacheChanged(object source, EventArrivedEventArgs e)
 {
     using (StreamWriter F = new StreamWriter("C:\\LABA4\\Laba-4.log", true))
     {
         F.WriteLine(DateTime.Now + " DNSCache.exe proccess changed");
     }
 }

 private void KeyValueChanged(object sender, EventArrivedEventArgs e)
 {
     string programName = (string)Registry.GetValue(FullPath,
         ValueName,
         InvalidShow);
     Console.Out.WriteLine("Found program {0}", programName);
 }

 public void delegate_EventArrived(object sender, EventArrivedEventArgs e)
 {
     lock (eventsCollectionLock)
     {
         eventsReceived.Add(e.NewEvent);
     }
 }

        public void DeviceChangeEventHandler(object obj, EventArrivedEventArgs args)
        {
            if (!isActive) return;

            List<Win32_PNPEntity_Wrap> newDeviceList = BuildDeviceList();
            LookForDifferences(newDeviceList, deviceList);
            deviceList = newDeviceList;
        }

        private void WatcherEventArrived(object sender, EventArrivedEventArgs e)
        {
            string eventType = e.NewEvent.ClassPath.ClassName;
            System.Console.WriteLine("Process "+eventType);
            var proc = new Win32_Process(e.NewEvent["TargetInstance"] as ManagementBaseObject);

            ProcessCreated.SafeInvoke(this, proc);
        }

        private static void ProcessStopDetected(object source, EventArrivedEventArgs e)
        {
            ManagementBaseObject process = (ManagementBaseObject)((ManagementBaseObject)e.NewEvent)["TargetInstance"];

            //Last three arguements of the new data point call here are filler data. Should be replaced when we actually know how to get the data.
            ProcessDataPoint pdp = new ProcessDataPoint(process["Name"].ToString(), ProcessDataPoint.PROCESS_TERMINATED, parseCIM(process["CreationDate"].ToString()), process["PeakWorkingSetSize"].ToString());
            controller.addDataPoint(container, pdp);
        }

 private void startWatch_EventArrived(object sender, EventArrivedEventArgs e)
 {
     if (ProcessWatcher.process_names.Contains(e.NewEvent.Properties["ProcessName"].Value.ToString().ToLower()))
     {
         int key = int.Parse(e.NewEvent.Properties["ProcessID"].Value.ToString());
         if (Add != null)
             Add(this, key);
     }
 }