: Analysis of the DownloadService or History databases in Chromium-based browsers explains how these strings are generated and stored as persistent metadata [1, 6].
: Forensic researchers use these timestamped, numbered files in the Downloads folder to reconstruct a timeline of user activity [2, 3].
If you are looking for a specific study, it may be a or a CTF (Capture The Flag) write-up where "Download Express(3).txt" was a key piece of evidence used to prove a user's intent or a system compromise.