DO NOT USE! SHA 1 Code Signing is depreciate

Dual Signing with a SHA1 and a SHA2 certificate:

signtool sign /t http://timestamp.digicert.com /sha1 XXSHA1CERTTHUMBPRINTXX WINQUAL.EXE

signtool sign /tr http://timestamp.digicert.com /td sha256 /fd sha256 /as /sha1 XXSHA256CERTTHUMBPRINTXX WINQUAL.EXE

NOTE:
XXSHA1CERTTHUMBPRINTXX is the thumbprint of your SHA1 code signing certificate
XXSHA256CERTTHUMBPRINTXX is the thumbprint of your SHA2 code signing certificate
WINQUAL.EXE is the executable file you want to sign