Curl.exe shipped with windows uses SCHANNEL for TLS handshake. Meanwhile the curl.exe downloaded from the curl website uses LibreSSL for TLS. SCHANNEL doesn’t t support exporting the TLS session key. You can use frida to hook into the windows related process and log the keys. Checkout this blog for detailed steps to export the keys using frida https://b.poc.fun/decrypting-schannel-tls-traffic/