What makes SilentCleanup a good target for UAC bypass?

SilentCleanup is a scheduled task that can be launched by standard users (Authenticated Users) but automatically elevates to high privileges (`RunLevel = Highest`). This lax permission control, combined with its use of the `%windir%` environment variable in the startup path, provides a hijacking opportunity. Similar to the [sdclt.exe bypass](/news/study-notes-of-using-sdclt-exe-to-bypass-uac), it fits the pattern of finding high-integrity programs that are triggerable by low-integrity users and whose startup process can be altered.