[a_c]

On hindsight, his friend might XOR a known password's hash with the clear text to uncover OxC9. But coming up the idea on the spot is pretty smart as well