UnitedHealthcare CEO Brian Thompson was killed in a dawn ambush Wednesday as he walked from his midtown hotel to the company’s annual investor conference across the street, blocks from tourist draws such as Radio City Music Hall and Rockefeller Center.

But days later, the gunman was still at large and the reason for the killing remained unknown, with New York City police saying evidence firmly points to it being a targeted attack.

Investigators worked to piece together more of the timeline of the gunman’s whereabouts before the shooting, examine security camera footage and even test a discarded water bottle and protein bar wrapper in a hunt for his DNA.

The words “deny,” “defend” and “depose” were found emblazoned on the ammunition, echoing a phrase used by insurance industry critics, two law enforcement officials said Thursday, speaking to The Associated Press on the condition of anonymity because they were not authorized to publicly discuss details of the investigation.

The messages mimic the phrase “delay, deny, defend,” which is commonly used by lawyers and insurance industry critics to describe tactics used to avoid paying claims. It refers to insurers delaying payment, denying a claim and then defending their actions. Health insurers like UnitedHealthcare have become frequent targets of criticism from doctors and patients for denying claims or complicating access to care.

Investigators also now believe the suspect may have traveled to New York last month on a bus that originated in Atlanta, one of the law enforcement officials said.

Police and federal agents have been collecting information from Greyhound in an attempt to identify the suspect and are working to determine whether he purchased the ticket to New York in late November, the official said.

Investigators were also trying to obtain additional information from a cellphone recovered from a pedestrian plaza through which the shooter fled.

A tip that the shooter may have stayed at a hostel brought police Thursday morning to at least two such establishments on Manhattan’s Upper West Side, according to one of the law enforcement officials briefed on the investigation. The photos made public Thursday were taken in the lobby of the HI New York City hostel.

“We are fully cooperating with the NYPD and, as this is an active investigation, can not comment at this time,” hostel spokesperson Danielle Brumfitt said in an emailed statement.

Police released new photos Thursday of a person wanted for questioning in connection with Thompson’s killing.

The images, showing an unmasked man smiling in the lobby of a Manhattan hostel, add to a collection of photos and video that have circulated since the shooting — including footage of the attack itself, as well as still frames of the suspected gunman stopping at a Starbucks beforehand.

Investigators believe the suspect used a fake New Jersey identification card when he checked in at the hostel, said one of the officials who spoke with the AP.

Employees who work at the hostel told investigators they remembered a man who almost always wore a mask when interacting with them or passing by the front desk. That person wore a jacket that looked like the one worn by the man pictured in surveillance images released after the shooting, the official said.

After the shooting, police said the gunman fled on a bicycle and was last seen riding into Central Park.

Based on surveillance video and evidence from the scene, investigators believe the shooter had at least some firearms training and experience with guns and that the weapon was equipped with a silencer, one of the law enforcement officials told the AP.

Investigators were also looking into whether the suspect had pre-positioned a bike as part of an escape plan, the official said.

Security video shows the killer approaching Thompson from behind, leveling his pistol and firing several shots, barely pausing to clear a gun jam while the executive tumbled to the sidewalk. Cameras showed him fleeing the block across a pedestrian plaza before getting on the bicycle.

Police released several images of the man wearing a hooded jacket and a mask that concealed most of his face — a look that would not have attracted attention on a chilly morning.

Thompson, a father of two sons who lived in a Minneapolis suburb, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and served as CEO for more than three years.

His wife, Paulette, told NBC News on Wednesday that he told her “there were some people that had been threatening him.” She didn’t have details but suggested the threats may have involved issues with insurance coverage.

The insurer’s parent company, UnitedHealth Group Inc., was holding its annual meeting in New York to update investors on its direction and expectations for the coming year. The company ended the conference after Thompson’s death.

UnitedHealthcare provides coverage for more than 49 million Americans and brought in more than $281 billion in revenue last year. It is the largest provider of Medicare Advantage plans in the U.S. and manages health insurance coverage for employers and state and federally funded Medicaid programs.

In October, UnitedHealthcare was named along with Humana and CVS in a Senate report detailing how its denial rate for prior authorizations for some Medicare Advantage patients has surged in recent years.