My both Wallets were offline, i didn't have any online backups.
So I thinking that 21.02 I was installing a miner, and maybe Phoenix miner or something different I downloaded.
I will scan my computers using SysInternal Autoruns, it have very good ability to check against VirusTotal all files that starts with system.
I think it was some single run app used to stole it.
No your wallets are not offline even if your cryptocurrencies is stored in desktop wallet as long as your computer is connected to the internet or is used for other purposes online then your wallet is still counted as an online wallet. This is one of the bad things on having a crypto stored on a multi-purpose computer as the risk will always be there as long as you are connected to the internet. Maybe the next time you will open an executable file scan it first to see if it is clean as you will never know if you are downloading a file that is vulnerable or a fake one. Also a lot of mining programs are having false positives when it comes to detections on anti-viruses so there is a chance it is not one of those files but from other downloaded files you have.