Online hackers are leaving surprising clues for cyber sleuths based on the time of their attacks — a trail suggesting the computer criminals are punching a clock for shift work. Chinese hackers, for instance, are on a Monday-Friday, 9 a.m. to 5 p.m. schedule, Beijing time, indicating they are likely paid employees based in that time zone. For instance, activities of the Syrian Electronic Army, a hacker group linked to the regime in Damascus, start with a bang on Sunday, the beginning of the work week in Syria. The al-Qasam Cyber Fighters, a group believed to be sponsored by Iran, shows the most activity Monday-Wednesday, when banking business in the West is at its peak, but is also active Saturday and Sunday.