aggressively scan every .jar, but totally ignores .net executables
no wonder they do something similar with go executables, it's easy to recognize them after all