perl -ne 'print if "$t$p$_" =~ /cmd\.exe/; ($p,$t)=($_,$p)'
perl -nwe '/cmd\.exe/ and $x = $.; print if $x && ($.-$x) <= 2'