what process does cygwin/sshd invoke when opens a port-forwarded xterm?

[n952162]

*ps -ef* only shows /xterm /instances that are created by the window
manager, not those created by sshd - at least, not with the name "xterm".