Why so many established connection on booting dispVM? Hacked?

Not a recommended strategy, as it can lead to profile fingerprinting (all profiles will have the same name for example).

Check out this guide instead: [Guide] Automatically install extensions and configure new (dispvm) hardened Firefox profiles with arkenfox user.js and policies