@nprofile1q... why don't they contact Microsoft support to help them figure out which application installed that file and how to update it, or to improve their OS so it can automatically track this information?
I don't have access to a Windows machine anymore, but I would've right clicked on the file to find its version and digital signature, and hopefully that would've told them who built the file.
There are also various scripts to try to find the (un)installer that'd be responsible for a particular file
https://github.com/Zero3/windows-installer-file-search, and the uninstallers might also be cached somewhere.
Although there are multiple installer formats, multiple package managers, etc. so it may not work.
(Although maybe standardising on .MSI and Winget could help)
Taking a step back though, if an organisation can't find out why one of their machines has an executable file/DLL and how it got there, then they have a bigger security problem than an unaddressed CVE in libcurl.dll, and they should work on fixing *that* first.