A flirtatious moment, writings on ammunition, and a bottle offer clues in search for gunman who killed UnitedHealthcare CEO

A photo depicting a hooded man smiling –– a face mask pushed down around his neck –– may provide clues to find the suspect in the fatal shooting of UnitedHealthcare CEO Brian Thompson.

An image released by the New York Police Department shows a man authorities call a “person of interest wanted for questioning” in the Wednesday morning killing. He is captured in a flirtatious moment with a female employee at a hostel on New York’s Upper West Side where he had been staying, a law enforcement official told CNN.

The employee asked the man to lower his face mask, which is when the photos released by authorities on Thursday were captured, the official told CNN.

“He lowers the mask, and gives that big smile,” CNN Chief Law Enforcement and Intelligence Analyst John Miller said. “That little flirtation between the two of them, in some good-humored way, actually yielded what is so far the most significant clue to identifying him.”

The images from the hostel are among the key pieces of evidence investigators have as they search for a shooter still on the loose after gunning down the health care executive in midtown Manhattan before seemingly vanishing.

Investigators also have a trail of surveillance video sightings and a burner phone and water bottle believed to have been dropped by the suspect when he fled the shooting scene – first on foot, then by bike – as well as ammunition with the words “depose” and “delay” written on them left at the scene of the crime, sources told CNN.

Authorities also have pieced together more about how and when the suspect got to New York City.

Now, the biggest challenge for the NYPD is tracing the movements of one person in a city populated with more than 8 million people, Andrew McCabe, a former FBI deputy director, told CNN Thursday morning.

Parent company adds security measures for employees

In the wake of the brazen attack, UnitedHealth Group, the parent company of Minnesota-based UnitedHealthcare, has laid out security plans for employees.

“We’re ensuring the safety, security and wellbeing of our employees,” said Andrew Witty, CEO of UnitedHealth Group in an email sent to employees on Thursday and obtained by CNN.

The health insurance company is fully cooperating with law enforcement as the manhunt continues, the email said.

“Several support mechanisms” are being put in place for employees, Witty said. “We have increased security at our campuses in Minnesota, in addition to sites in Washington, D.C., and New York City areas.”

No visitors are allowed on administrative campuses through the end of the week, Witty added.

How the suspect got to New York City

Video of the brazen killing –– carried out in full view of pedestrians in the busy Manhattan area –– helped investigators determine the suspect’s first moves after the shooting, police said.

The masked gunman waited for Thompson outside the Hilton Midtown shortly before 7 a.m. Wednesday then shot him multiple times before fleeing through an alleyway and getting on an electric bike. He was last seen at 6:48 a.m. headed into Central Park, New York police said.

Thompson, who lived in Minnesota and was on his way to the hotel to attend his company’s annual investor conference, was pronounced dead less than half an hour later.

New details are now emerging about the suspect’s movements in the days leading up to the shooting.

The suspected gunman traveled on a Greyhound bus that started its route in Atlanta, law enforcement sources told CNN. Authorities do not know whether the suspect boarded in Atlanta or elsewhere, sources said.

Police believe the assailant arrived at New York City’s Port Authority bus terminal on November 24 – 10 days before the shooting – then checked into the Upper West Side hostel, a law enforcement official said.

After that, he appears to have moved around the city, the official said.

The suspected shooter appeared to wear a mask throughout most of his stay at the hostel, law enforcement sources told CNN. He was housed in a multi-person room with two other males, one source said.

The suspect checked out of the hostel on November 29 and checked back in on November 30, law enforcement sources told CNN.

He paid the establishment in cash, according to one source –– checking into the hostel using a fake New Jersey driver’s license, a law enforcement official previously told CNN.

Clues from the crime scene

A shell casing recovered from one of the bullets fired at Thompson had the word “depose” written on it, while “delay” was written on a live round that was ejected when the shooter appeared to be clearing a jam, law enforcement sources told CNN on Thursday.

Police are exploring whether the words found indicate a motive, pointing to a popular phrase in the insurance industry: “delay, deny, defend.”

Police are still trying to determine where the suspect got the e-bike, however investigators are developing clues from the burner phone and water bottle believed to have been dropped by the gunman when he fled the shooting scene.

A fingerprint was lifted from the water bottle, a law enforcement official told CNN. The print, however, is smudged making it less conclusive, the official said.

The phone could yield fingerprints, DNA and –– if police technicians can unlock the phone –– other clues to the suspect’s identity, investigators said. Even a disposable burner phone might yield clues about communications and searches before the shooting. Police on Thursday afternoon were still trying to access that phone, a law enforcement official said.

Authorities have not found the gunman’s bike, weapon or backpack.

A needle in a haystack

The suspect could have taken steps after fleeing to Central Park to evade detection, like changing into a different set of clothes, McCabe said.

Through Wednesday, police deployed mobile field forces to conduct a grid search, looking through garbage cans, dumpsters and bushes in an extensive search for a missing gray backpack, which the assailant was seen wearing during the shooting, a senior law enforcement official told CNN.

Police initiated the search after detectives reviewed security footage of the suspect no longer wearing the backpack after leaving Central Park through the West 77th street exit.

CNN’s Meg Tirrell, John Miller, Shimon Prokupecz, Amanda Musa, Ashley R. Williams, Linh Tran, Sara Smart, Taylor Galgano, David Goldman, Rebekah Riess and Elise Hammond contributed to this report.

For more CNN news and newsletters create an account at CNN.com