NEW YORK — As the investigation into a masked gunman who stalked and killed the head of one of the largest U.S. health insurers moved into its third day Friday, possible leads emerged about his travel before the shooting.

UnitedHealthcare CEO Brian Thompson was killed in a dawn ambush Wednesday as he walked from his midtown hotel to the company’s annual investor conference across the street, just blocks from Radio City Music Hall and Rockefeller Center.

But days later, the gunman’s whereabouts and identity remained unknown as did the reason for the killing. New York City police say evidence firmly points to it being a targeted attack.

Related Story: NY Police Hunt for ‘Brazen’ Masked Killer of UnitedHealthcare CEO

Investigators Piece Together Gunman’s Timeline

Investigators worked to piece together more of the timeline of the gunman’s movements before the shooting, examine security camera footage and even test a discarded water bottle and protein bar wrapper in a hunt for his DNA.

The words “deny,” “defend” and “depose” were scrawled on the ammunition, two law enforcement officials said Thursday, speaking to The Associated Press on the condition of anonymity because they were not authorized to publicly discuss details of the investigation. The messages mirror the phrase “delay, deny, defend,” which is commonly used by lawyers and critics about insurers that delay payments, deny claims and defend their actions.

Investigators also now believe the suspect may have traveled to New York last month on a bus that originated in Atlanta, one of the law enforcement officials said. An Atlanta police spokesperson said Friday that the agency has not been asked to join the investigation.

Police and federal agents have been collecting information from Greyhound to try to identify the suspect and are working to determine whether he purchased the ticket to New York in late November, the official said.

Related Story: The UnitedHealthcare CEO Has Been Shot and Killed Outside a New York City ...

New Leads and Evidence Emerge

Investigators also were trying to obtain additional information from a cellphone recovered from a pedestrian plaza where the shooter fled.

A tip that the shooter may have stayed at a hostel brought police Thursday morning to at least two such establishments on Manhattan’s Upper West Side, according to one law enforcement official briefed on the investigation. The photos made public Thursday were taken in the lobby of the HI New York City hostel.

“We are fully cooperating with the NYPD and, as this is an active investigation, can not comment at this time,” hostel spokesperson Danielle Brumfitt said in an email.

Police released new photos Thursday of a person wanted for questioning in connection with Thompson’s killing.

The images, showing an unmasked man smiling in the lobby of a Manhattan hostel, add to a collection of photos and video circulated since the shooting — including footage of the attack itself, as well as images of the suspected gunman stopping at a Starbucks beforehand.

Investigators believe the suspect used a fake New Jersey identification card when he checked in at the hostel, said one of the officials who spoke with the AP.

Employees who work at the hostel told investigators they remembered a man who almost always wore a mask when interacting with them or walking by the front desk. The person wore a jacket that looked like the one worn by the man pictured in surveillance images, the official said.

After the shooting, police said the gunman fled on a bicycle and was last seen riding into Central Park, blocks from the shooting.

Related Story: Ammunition Used in CEO’s Killing Had ‘Deny,’ ...

Suspect’s Possible Training and Preparation

Based on surveillance video and evidence from the scene, investigators believe the shooter had at least some firearms training and experience with guns and that the weapon was equipped with a silencer, one of the law enforcement officials told the AP.

Investigators were also looking into whether the suspect had pre-positioned a bike as part of an escape plan, the official said.

Security video shows the killer approaching Thompson from behind, leveling his pistol and firing several shots, barely pausing to clear a gun jam while the executive tumbled to the sidewalk.

Police released several images of the man wearing a hooded jacket and a mask that concealed most of his face — a look that would not have attracted attention on a chilly morning.

Thompson, a father of two sons who lived in a Minneapolis suburb, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and served as CEO for more than three years.

The insurer’s parent company, UnitedHealth Group Inc., was holding its annual meeting in New York to update investors on its direction and expectations for the coming year. The company abruptly ended the conference after Thompson’s death.

UnitedHealth Group said late Thursday that it was focused on supporting Thompson’s family, ensuring the safety of employees and assisting investigators. “While our hearts are broken, we have been touched by the huge outpouring of kindness and support in the hours since this horrific crime took place,” the company said.

UnitedHealthcare provides coverage for more than 49 million Americans and brought in more than $281 billion in revenue last year. It is the largest provider of Medicare Advantage plans in the U.S. and manages health insurance coverage for employers and state and federally funded Medicaid programs.

In October, UnitedHealthcare was named along with Humana and CVS in a Senate report detailing how its denial rate for prior authorizations for some Medicare Advantage patients has surged in recent years.