This is the legitimate vendor signature. However, attackers often preserve this string to lend authenticity to malicious renames.