filebyproc.d(1m) on macOS
The text d2a7a23df56f, as Mac OS X 10.5.8, Mac OS X 10.5.7, Mac OS X 10.5.6, Mac OS X 10.5.5, Mac OS X 10.5.4, Mac OS X 10.5.3, Mac OS X 10.5.2, Mac OS X 10.5.1, Mac OS X 10.5 shipped it.
snoop opens by process name. Uses DTrace.