CNN
—

A photo showing a smiling man wearing a hoodie and his mask down could provide important clues that could help identify the suspect in the fatal shooting of UnitedHealthcare CEO Brian Thompson.

A picture published The photo released by the New York Police Department shows a man authorities describe as a “person of interest wanted for questioning” in Wednesday’s killing. He was filmed in a flirtatious moment with a female employee at a hostel on New York’s Upper West Side where he was staying, a police official told CNN.

The employee asked the man to lower his face mask, which is when the photos released by authorities on Thursday were taken, the official told CNN.

“He lowers his mask and smiles broadly,” said John Miller, CNN’s chief law enforcement and intelligence analyst. “This little flirtation between the two, carried out in a good-humored manner, actually provided the most important clue to his identification to date.”

The images from the hostel are among the most important pieces of evidence investigators have as they search for a gunman who is still at large after he shot and killed the health care executive in Midtown Manhattan on Wednesday morning before apparently had disappeared.

Investigators also have a trail of surveillance video sightings, as well as a burner phone and a water bottle believed to have been dropped by the suspect as he fled the scene – first on foot, then on a bicycle – as well as ammunition with the words “depose” and ” depose” sources told CNN that “delay” was written on them and was left at the scene.

Video of the brazen murder, which took place in full view of pedestrians in the busy Manhattan area, helped investigators determine the suspect’s first steps after the shooting, police said.

The masked gunman waited for Thompson outside the Hilton Midtown just before 7 a.m. Wednesday, then shot him several times before escaping through an alley and getting on an electric bicycle. He was last seen heading to Central Park at 6:48 a.m., the NYPD said.

Thompson, who lived in Minnesota and was on his way to the hotel to attend his company’s annual investor conference, was pronounced dead less than half an hour later.

Now new details are emerging about the suspect’s movements in the days leading up to the shooting.

The suspected shooter was traveling on a Greyhound bus that started its route in Atlanta, multiple law enforcement sources told CNN. Sources said authorities don’t know whether the suspect boarded the ship in Atlanta or elsewhere.

Police believe the attacker arrived at the New York Port Authority bus station on Nov. 24 – 10 days before the shooting – and then checked into a hostel on the Upper West Side, a police official said.

He then apparently moved through the city, the official said.

Law enforcement sources told CNN that the suspected shooter appeared to have been wearing a mask for most of his stay at the hostel. According to a source, he was staying in a shared room with two other men.

The suspect left the hostel on November 29 and checked back in on November 30, multiple law enforcement sources told CNN.

According to a source, he paid for the facility in cash – using a fake New Jersey driver’s license when checking into the hostel, a law enforcement official previously told CNN.

Police are still trying to find out where the suspect got the e-bike. However, investigators are developing clues from the burned phone and water bottle that the shooter is believed to have dropped as he fled the scene.

A fingerprint was taken from the water bottle, a police official told CNN. However, the print was blurred, making it less meaningful, the official said.

The phone could provide fingerprints, DNA and — if police technicians can unlock the phone — other clues to the suspect’s identity, investigators said. Even a disposable cell phone could provide evidence of communications and searches before the shooting. As of Thursday afternoon, police were still trying to access the phone, a police official said.

Authorities searched the area but did not find the shooter’s bike or weapon.

A shell casing recovered from one of the bullets fired at Thompson had the word “depose” written on it, while “delay” was written on a live cartridge that was ejected when the shooter apparently jammed eliminated, law enforcement officials told CNN on Thursday.

Police are investigating whether the words found indicate a motive, citing a popular phrase in the insurance industry: “delay, deny, defend.”

The biggest challenge for the NYPD is tracking a person’s movements in a city of more than 8 million people, Andrew McCabe, a former FBI deputy director, told CNN on Thursday morning.

The suspect could have taken steps to avoid detection after fleeing to Central Park, such as changing into different clothing, McCabe added.

By Wednesday, police were using mobile field forces to conduct a grid search, searching trash cans, dumpsters and bushes to search for a missing gray backpack that the attacker had been carrying during the shooting, a senior police official told CNN.

Police launched the search after investigators reviewed security footage that showed the suspect no longer wearing the backpack after exiting Central Park via the West 77th Street exit.

According to the officer, investigators were unable to find the backpack.