creatbyproc.d(1m) on macOS
The text df89aaf84b07, as Mac OS X 10.5.8, Mac OS X 10.5.7, Mac OS X 10.5.6, Mac OS X 10.5.5, Mac OS X 10.5.4, Mac OS X 10.5.3, Mac OS X 10.5.2, Mac OS X 10.5.1, Mac OS X 10.5 shipped it.
snoop creat()s by process name. Uses DTrace.