You can watch as these bitcoin wallets receive ransomware payments from the ongoing global cyberattack

An ongoing ransomware attack that affected more than 45,000 systems on Friday has spread to 74 countries, locking doctors in the U.K. out of patient records and reportedly forcing emergency rooms to send patients to other hospitals. The attack has also reportedly hit a Spanish telecommunications company and a Russian cellphone operator.

Security experts say the strain of ransomware being used, called the “Wanna Decryptor,” is exploiting a vulnerability in Microsoft Windows that was leaked last month by an anonymous hacker group calling itself the Shadow Brokers. The group claimed it had stolen the exploits it released from the US National Security Agency.

Ransomware is a form of malware that encrypts a computer’s files and displays a message to the user, saying it will decrypt the files for a payment, typically via bitcoin. The message displaying on NHS computers and others has been circulated in photos on social media, and it includes instructions to send $300 or $600 to a bitcoin address.

Those bitcoin addresses are publicly accessible, and you can view their associated wallets as victims send the hackers money in hopes of regaining access to their files. Note that these addresses have been collected from photos on social media, and although they’ve widely been accepted by experts as genuine, Quartz has not seen the affected computers firsthand.

Here are three of those bitcoin wallets, and their associated transactions:

Wallet 1 (12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw)

This wallet has received 8 payments totaling 1.33236738 in bitcoin ($2,274.56 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

Wallet 2 (13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94)

This wallet has received 13 payments totaling 2.41710431 in bitcoin ($4,126.38 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

Wallet 3 (115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn)

This wallet has received 7 payments totaling 1.00701804 in bitcoin ($1,719.14 USD) at the time of this post’s publication. The ransomware associated with this address demands payments of $300. You can view all of its transactions here.

In total, across these three wallets, there have been 28 payments totaling $8,120.08.

Send us more bitcoin addresses

We are attempting to track bitcoin wallets associated with this attack that we’re able to find. If you know of a bitcoin address not listed here, please send it to kc@qz.com or tweet it to @collinskeith, along with a photo of the associated ransomware message.