Ransomware Execution PROvenance Dataset (REPROD)

A collection of ProcMon log files (PML) files associated with executions of ransomware binaries downloaded from MalwareBazaar. Files are named after the sha256 hash used on MalwareBazaar. These PML files were processed with the SPADE provenance system and queried to produce a subgraphs that are provided as DOT files.  Only a subset of all the executions (n=405) that were performed are in this archive as the PML files are large, all DOT files that were obtained (n=861)are in this dataset.