There is an interesting phenomenon that occurs often: when a gap down of this size occurs, followed by a bottoming action and a large white candle forms, this often becomes an island gap. HFTs that gapped the stock down gap it up again.
The fact that the gap down candle is a huge white candle for this chart indicates that the gap down is below fundamental values and Dark Pools were the buyers against the HFT selling. The drop in Accumulation/Distribution at that time was smaller funds dumping which often triggers Dark Pool TWAPs. NASDAQ:NTCT has a high Percentage of Institutional Holdings at this time and it's a lower-priced stock in a pricey market.