Yes, how does the .exe keep its valid digital signature if the hash of the .exe is modified for each person?

Would someone have documentation about which bytes we can modify in a code-signed .exe without making the digital signature invalid?

In the case it's not possible, does this mean Mozilla generates a new .exe on the fly + codesigns the .exe on the fly for each new download?