$ 0 0 Looks like the Sophos AutoUpdate impersonation account. This article should help: https://community.sophos.com/kb/en-US/58627