New clues emerged Thursday in the hunt for the masked gunman who stalked and killed UnitedHealthcare CEO Brian Thompson, including possible leads about his travel before the shooting and a message scrawled on ammunition found at the crime scene.

The words “deny,” “defend” and “depose” were found emblazoned on the ammunition, echoing a phrase used by insurance industry critics, two law enforcement officials said Thursday.

The words were written in permanent marker, according to one of the two officials, who were not authorized to publicly discuss details of the investigation and spoke to The Associated Press on the condition of anonymity.

Investigators also now believe the suspect may have travelled to New York last month on a bus that originated in Atlanta, one of the law enforcement officials said.

Police and federal agents have been collecting information from Greyhound in an attempt to identify the suspect and are working to determine whether he purchased the ticket to New York in late November, the official said.

Police also released new photos Thursday of a person wanted for questioning in connection with Thompson's killing.

The images, showing an unmasked man smiling in the lobby of a Manhattan hostel, add to a collection of photos and video that have circulated since the shooting — including footage of the attack itself, as well as still frames of the suspected gunman stopping at a Starbucks beforehand.

Thompson, the head of one of the largest US health insurers, died in a dawn ambush Wednesday as he walked from his midtown hotel to the company's annual investor conference at a Hilton across the street. The reason for the killing remained unknown, but New York City police say evidence firmly points to it being a targeted attack.

The messages on the 9 mm ammunition found at the scene of the shooting mimic the phrase “delay, deny, defend,” which is commonly used by lawyers and insurance industry critics to describe tactics used to avoid paying claims.

It refers to insurers delaying payment, denying a claim and then defending their actions. Health insurers like UnitedHealthcare have become frequent targets of criticism from doctors and patients for denying claims or complicating access to care.

Investigators also recovered a cellphone from a pedestrian plaza through which the shooter fled. Inside a nearby trash can, they found a water bottle and protein bar wrapper that they say the gunman purchased from Starbucks minutes before the shooting. The city's crime lab is examining those items for DNA and fingerprints.

Investigators were still trying to obtain additional information from the phone Thursday, the law enforcement official said.

A tip that the shooter may have stayed at a hostel brought police Thursday morning to at least two such establishments on Manhattan's Upper West Side, according to one of the law enforcement officials briefed on the investigation. The photos made public Thursday were taken in the lobby of the HI New York City hostel.

“We are fully cooperating with the NYPD and, as this is an active investigation, can not comment at this time,” hostel spokesperson Danielle Brumfitt said in an emailed statement.

Investigators believe the suspect used a fake New Jersey identification card when he checked in at the hostel, said one of the officials who spoke with the AP.

Employees who work at the hostel told investigators they remembered a man who almost always wore a mask when interacting with them or passing by the front desk. That person wore a jacket that looked like the one worn by the man pictured in surveillance images released after the shooting, the official said.

After the shooting, police said the gunman fled on a bicycle and was last seen riding into Central Park.

Members of the public have flooded police with tips — many unfounded. Police searched a Long Island Rail Road train Wednesday night after a commuter claimed to have spotted the shooter, but they found no sign of the gunman.

“We're following up on every single tip that comes in,” said Assistant Commissioner Carlos Nieves, a police spokesperson. ”That little piece of information could be the missing piece of the puzzle that ties everything together.”

Based on surveillance video and evidence from the scene, investigators believe the shooter had at least some firearms training and experience with guns and that the weapon was equipped with a silencer, one of the law enforcement officials told the AP.

Investigators were also looking into whether the suspect had pre-positioned a bike as part of an escape plan, the official said.

Security video shows the killer approaching Thompson from behind, leveling his pistol and firing several shots, barely pausing to clear a gun jam while the executive tumbled to the sidewalk. Cameras showed him fleeing the block across a pedestrian plaza before getting on the bicycle.

Police released several images of the man wearing a hooded jacket and a mask that concealed most of his face — a look that would not have attracted attention on a chilly morning.

Thompson, a father of two sons who lived in a Minneapolis suburb, had been with Minnetonka, Minnesota-based UnitedHealthcare since 2004 and served as CEO for more than three years.

His wife, Paulette, told NBC News on Wednesday that he told her “there were some people that had been threatening him.” She didn't have details but suggested the threats may have involved issues with insurance coverage.

The insurer's parent company, UnitedHealth Group Inc., was holding its annual meeting in New York to update investors on its direction and expectations for the coming year. The company ended the conference after Thompson's death.

UnitedHealthcare provides coverage for more than 49 million Americans and brought in more than $281 billion in revenue last year. It is the largest provider of Medicare Advantage plans in the U.S. and manages health insurance coverage for employers and state and federally funded Medicaid programs.

In October, UnitedHealthcare was named along with Humana and CVS in a Senate report detailing how its denial rate for prior authorizations for some Medicare Advantage patients has surged in recent years.