JuicyPotato is a Windows privilege-escalation utility abused during Lazarus intrusions rather than malware uniquely developed by the group. In attacks on IIS and Microsoft SQL Server systems, a Themida-packed copy named usopriv.exe was created by the IIS w3wp.exe process. Operators used it to obtain privileges unavailable to the compromised service account, verified escalation with whoami, and launched a DLL loader through rundll32. That loader searched several paths for a GIF-disguised encrypted data file, decrypted its configuration and PE content, and executed the payload in memory.