So my wallet must have been compromised then somehow.

I did have it on 3 places - private key in a completely random txt file with unrelated name in my mobile phone, renamed wallet.dat on my home computer in a root of E: partition (which had the jhProtominer.exe recently, which I removed later, really don't have a clue where it came from), and original wallet at workplace. I doubt that Private Key was stolen from mobile, my home computer may be an issue, but then again, the wallet was renamed plus it wasn't in default MoonCoin location, and my workplace original wallet (where appdata are stored elsewhere than default location too). This is so strange.

Also, two transactions happened. 71,800,000 MOON and 52019 MOON, both to different addresses. I wonder why would thief leave me with 75,000 MOON then.