Those weird trusted root CA's are preloaded by Microsoft https://support.microsoft.com/en-us/kb/293781