Even without administrative privileges, your malware can still do lots of interesting things: full access to the user's files, settings and browser history, full internet access, automatic launch on startup.