Decrypting usenet headers

[radix]

Code:

echo -n 'U2FsdGVkX19bCgrkbEjt4gDrFKNANCce' | base64 -d | xxd
00000000: 5361 6c74 6564 5f5f 5b0a 0ae4 6c48 ede2  Salted__[...lH..
00000010: 00eb 14a3 4034 271e                      ....@4'.

If we pull out the Salted__ bit then you get a len consistent with a number of hash types (32).  However that means the salt is hiding elsewhere.  Without seeing the source it would be hard to figure out a) the hashing, b) what value in the header is the salt.