Maybe something like:
(names of it, modification times of it) of files whose (name of it as lowercase starts with "C-00000291" as lowercase) of x64 folder "C:\windows\system32\drivers\crowdstrike"
Also, consider keeping an eye on CrowdStrike Issue 2024-07-19 as I expect we’ll have more to share there that may help.
(you were quite close with your second query above, but included the file name in the folder reference…removing it should allow it to return properly: exists file whose (name of it starts with "C-00000291") of x64 folders "c:\windows\system32\drivers\CrowdStrike\")