How to interprete output of "docker history" CLI?

Trying to understand image sizes by looking at say microsoft\iis image
Output of docker history microsoft/iis --no-trunc showing following

IMAGE CREATED CREATED BY SIZE COMMENT
sha256:7d4c79e586fdf0da8dbf31a6bcd1a441dd8abd18cc587a68a844e7aa18817919 11 days ago cmd /S /C #(nop) ENTRYPOINT [“C:\ServiceMonitor.exe” “w3svc”] 280 MB
11 days ago cmd /S /C #(nop) ADD file:d1c2ff374479851de661eb3f54841c20249ceaa2b80e5873a86b3ca4abc83b51 in \ServiceMonitor.exe 1.88 GB
11 days ago cmd /S /C powershell -Command Add-WindowsFeature Web-Server 7.68 GB

What I don’t understand is how layer second from the bottom which has addition of single 100 KB file inflated image size by 1.88GB? Or am I reading output wrong?

The way the base layers work on Windows is a little different, and I think it’s causing some problems for the docker history display. We’re working with Microsoft to address this.

Michael