more is a legitimate program (it reads a file and writes it out one page at a time), if it is the real more. It is a memory hog in that (unlike the more advanced pager less) it reads the entire file into memory.

I did an experiment to see if I could get the real more to show similar fds to you. I piped yes "" | head -n10000 >/tmp/test, then ran more < /tmp/test 2>/dev/null. Then I ran ls -l /proc/`pidof more`/fd.

Results:

lr-x------ 1 andrew andrew 64 Nov  5 14:56 0 -> /tmp/test
lrwx------ 1 andrew andrew 64 Nov  5 14:56 1 -> /dev/pts/2
l-wx------ 1 andrew andrew 64 Nov  5 14:56 2 -> /dev/null
lrwx------ 1 andrew andrew 64 Nov  5 14:56 3 -> 'anon_inode:[signalfd]'

I think this suggests your open files are probably consistent with the real more when errors are piped to /dev/null. Most likely, you were running something that called more to output something to you (or someone else logged in on a PTY) that had been written to /tmp/RG3tBlTNF8. Next time, you could find the parent of the more process, or look up what else is attached to the same PTS with the fuser command.

~~Uhm, so what's the name of the binary? This is just a list of open files.~~ I missed that it's "more"...

Yeah, next time don't panic. Use ps and pstree and fuser (or the programs you like) to first find out the executable filename with full path and which program started it. Then you can kill it and you'll have some info to start debugging things.

Check it in VirusTotal

Maybe? It could be numerous things. Are you using containers? Did an update or upgrade fail? Did you install and or patch something? Anything in sys logs giving off ERR or WARN? What’s your system and distro? What was the last few things you did before this popped?

Reboot