Furthermore we can surmise that it's on empty stock.
Or it could be any of these headcodes for a local train to station on a non-electrified route using any of the routes below:
However, as you say, the likelihood it is an ECS working to Charing Cross, Holborn, London Bridge, Bricklayers' Arms or to stabling sidings such as New Cross. We will never know!
London Bridge mentioned below also includes trains starting from Cannon Street, Holborn or Charing Cross and passing through London Bridge.
London Bridge or Bricklayers' Arms and Addiscombe.
London Bridge or Bricklayers' Arms and Tonbridge or Reading via East Croydon and Redhill
or London Bridge or Bricklayers' Arms and Gillingham, Faversham, Ramsgate or Dover via Chislehurst Loop and Chatham.
London Bridge or Bricklayers' Arms and Ramsgate via Tonbridge and Canterbury West
or London Bridge or Bricklayers' Arms and Tonbridge or Reading via East Croydon and Redhill.
London Bridge or Bricklayers' Arms and Eastbourne or Hastings via Quarry line - very unlikely -
or London Bridge or Bricklayers' Arms and Hastings via Chislehurst and Tunbridge Wells Central.
London Bridge or Bricklayers' Arms and Dover, Ramsgate or Hastings via Chislehurst, Swanley, Otford and Sevenoaks.
To London Midland Region via West London line - this would be a rather convoluted route!
All stations to Aldershot Government Sidings - unlikely.