1. A method of presenting content indicative of one or more entities which contributed to a window being displayed using a processing system, wherein the method comprises: (a) setting the window as a starting entity, wherein the window comprises a webpage being displayed by an internet browser, the webpage having a uniform resource locator (URL); (b) determining one or more properties of the starting entity, the one or more properties including the URL of the webpage; (c) identifying, using the one or more properties and at least one rule, the one or more entities related to the starting entity which contributed to the window being displayed, wherein identifying the one or more entities comprises: identifying a registry entry that corresponds to the starting entity based at least in part on a determination that a value of the registry entry corresponds to the URL of the webpage; determining a timestamp associated with the registry entry; identifying one or more files of the processing system with timestamps within a predetermined range of the timestamp associated with the registry entry; and indicating each identified file as a contributing entity; (d) determining, for each of the one or more entities related to the starting entity, whether a direct link or an indirect link exists from a related entity to the starting entity; (e) determining a link distance value between the starting entity and each of the one or more entities related to the starting entity; (f) determining, for each of the one or more entities related to the starting entity, a threat value based at least in part on one or more characteristics of a respective entity related to the starting entity, wherein the one or more characteristics of the respective entity related to the starting entity comprise at least a frequency of connecting to a remote network address within the predetermined range of the timestamp associated with the registry entry; (g) determining a weighted value for each of the one or more entities related to the starting entity, wherein the weighted value comprises at least the link distance value; (h) identifying whether each of the one or more entities related to the starting entity is malicious or non-malicious, wherein the identification comprises determining whether the threat value is below a threshold value; and (i) providing to a user, using the processing system, content indicative of the one or more entities which contributed to the window being displayed, the content including the determined threat value for each of the one or more related entities.