We can't rely on running_processes for that, since it now also counts
processes waiting for SIGKILL and those aren't included in snapshots.

Unlike dlls, executables can have the same name without necessarily
being the same application, so defaulting to native is more likely to
do the right thing.

it's completely different from the others anyway.