Possible leads regarding his travel before the shooting and a statement scrawled on ammunition discovered at the crime site surfaced as the search for a masked gunman stalking and killing the CEO of one of the biggest U.S. health insurers entered its third day Friday.

Walking from his midtown hotel to the company’s annual investor conference across the street, blocks from tourist attractions including Radio City Music Hall and Rockefeller Center, UnitedHealthcare CEO Brian Thompson was slain in a morning attack Wednesday.

Days later, the gunman was still at large and the cause of the murder remained unexplained; New York City police assert that evidence definitely leads to a targeted attack.

Examining security camera footage and even testing a discarded water bottle and protein bar wrapper in a search for the gunman’s DNA, investigators sought to piece together more of his locations before the shooting.

READ MORE: Colt Gray, The Suspect In The Georgia School Shooting, Appears In Court, As Does His Father

Two law enforcement officials said Thursday, speaking to The Associated Press on the condition of anonymity because they were not authorized to publicly discuss specifics of the investigation, the words “deny,” “defend,” and “depose” found emblazoned on the ammunition echoing a phrase used by insurance industry detractors.

The communications resemble the term ” Delay, deny, defend,,” which is often used by opponents of the insurance business and attorneys to characterize strategies meant to evade paying claims. It speaks about insurance rejecting a claim, postponing payments, then justifying their behavior. Doctors and patients have started routinely criticizing health insurers such as UnitedHealthcare for either rejecting claims or complicated access to treatment.

One of the law enforcement officials said, investigators also now believe the suspect might have arrived in New York last month on a bus originating in Atlanta.

The insider said that police and federal officials have been gathering information from Greyhound in an effort to identify the suspect and are trying to ascertain whether he bought the ticket to New York late November.

READ MORE: Secret Service Director Breaks Silence On Trump Attack And Accepts Full Responsibility

Investigators also sought further information from a cellphone retrieved near a public plaza through which the gunman escaped.

One of the law enforcement sources informed on the inquiry said that a tip the shooter might have slept at a hostel sent officers Thursday morning to at least two such businesses on Manhattan’s Upper West Side. Thursday’s public photos came from the HI New York City hostel lobby.

“We are fully cooperating with the NYPD and, as this is an active investigation, can not comment at this time,” hostel spokesman Danielle Brumfitt emailed.

Thursday’s police releases fresh pictures of a suspect wanted for interrogation related to Thompson’s murder.

Together with still frames of the alleged gunman pausing at a Starbucks earlier, the images depicting an uncovered guy grinning in the lobby of a Manhattan hostel add to a collection of pictures and video that have gone viral since the shooting.

READ MORE: A Mexican Mayoral Candidate Was Assassinated At A Point-Blank Range, And The Attacker Was Also Killed

Said one of the officials who contacted the AP, investigators think the suspect checked in at the hostel using a phoney New Jersey identification card.

Workers of the hostel reported to investigators they recalled a man they interacted with or passed by the front desk virtually constantly wearing a mask. That individual sported a jacket that resembled the one the man shown in security photos published following the shooting, the official added.

Police claimed the gunman left on a bicycle following the attack and last observed cycling into Central Park.

Investigators believe the gunman had at least some firearms training and familiarity with guns and that the weapon was fitted with a silencer, one of the law enforcement officials told the AP based on surveillance video and scene evidence.

The person added mentioned investigators looking into whether the suspect had pre-positioned a bike as part of an escape route.

Security cameras show the attacker approaching Thompson from behind, aiming his pistol and firing six rounds, hardly stopping to clear a gun jam as the CEO fell to the sidewalk. Before mounting the bicycle, cameras showed him running from the block across a public plaza.

On a cold morning, police released multiple pictures of the man sporting a hooded jacket and a mask covering most of his face – a look that would not have drawn notice.

Living in a Minneapolis suburb, Thompson, a father of two sons, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and spent more than three years acting CEO.

On Wednesday, Paulette, his wife, told NBC News he informed her “there were some people that had been threatening him.” She lacked specifics but speculated that the threats might have related to insurance coverage problems.

UnitedHealth Group Inc., the parent company of the insurer, was updating investors on its vision and expected course for the next year at its annual conference in New York. After Thompson passed away, the firm called off the conference.

Last year UnitedHealthcare raked in more than $281 billion healthcare income and covers about 49 million Americans. Managing health insurance coverage for state and nationally sponsored Medicaid programs as well as Medicare Advantage plans, it is the biggest supplier of both.

UnitedHealthcare, along with Humana and CVS, was listed in a Senate report in October on how their prior authorization denial rate for some Medicare Advantage customers had skyrocketed recently.

Source