Looks like there are many possible scenario on how your Bitcoin was stolen and there's no way to find out which scenario actually happened, so i strongly suggest you to secure all your devices and server (if you haven't done it yet).
Those are rough estimation and actual time to brute-force the password depends on algorithm used for encryption (encryption require more computational power compared with hashing) and hardware owned by the hacker.