25 Suspicious Code Fragments in CoreCLR (viva64.com)

And another more verified projects: http://www.viva64.com/en/a/0084/ :)