Zsh +coreutils, 48 bytes

jot -rw%x 38 0 15|sed '9~5s/./-/;29d;34d'|rs -g0

Try it online!

Tcl, 94 bytes

time {puts -nonewline [format %x[expr [incr i]%4|$i<7|$i>21?"":"-"] [expr int(rand()*16)]]} 32

Try it online!

time {append g [format %x[expr [incr i]%4|$i<7|$i>21?"":"-"] [expr int(rand()*16)]]} 32;puts $g

time {append g [format %x[expr [incr i]%4||$i<7||$i>21?"":"-"] [expr int(rand()*16)]]} 32;puts $g

time {incr i;append g [format %x[expr $i%4||$i<7||$i>21?"":"-"] [expr int(rand()*16)]]} 32;puts $g

time {incr i;append g [format %x[expr !($i%4)&&$i>7&&$i<21?"-":""] [expr int(rand()*16)]]} 32;puts $g

proc D {n\ 4} {time {append g [format %x [expr int(rand()*16)]]} $n;set g}
puts [D 8]-[D]-[D]-[D]-[D 12]

q, 13 bytes

Not sure if it violates "No built-ins." hoever it's not using the built-in method to generate a random GUID which would be rand 0Ng. Generates 16 random bytes and packs them into a guid.

0x0 sv 16?0x0

Example

q)0x0 sv 16?0x0
8e204f8d-5a0b-b188-1131-4ff06efe824d

05AB1E, 19 18 bytes

ŽΣÌε4*F15ÝΩh}J}'-ý

Outputs in uppercase.

Try it online.

Explanation:

ŽΣÌ                  # Push compressed integer 21113
   ε          }      # Pop and map over each of its digit:
    4*               #  Multiply the current digit by 4
      F     }        #  Pop and loop that many times:
       15Ý           #   Push a list in the range [0,15]
          Ω          #   Pop and pick a random number from it
           h         #   Convert it to hexadecimal
            }J       #  After the inner loop: Join the stack together
               }'-ý '# After the map: join the list with "-"-delimiter together
                     # (after which this string is output implicitly as result)

See this 05AB1E tip of mine (section How to compress large integers?) to understand why ŽΣÌ is 21113.

Julia, 57,60 55 bytes

!n=bytes2hex(rand(UInt8,n))
join(.![4,2,2,2,6],-)|>show

• 57->60 a mistake
• 60->55 by @MarcMush and the broadcasting :-)

Attempt This Online!

Vyxal, 120 bits^v2, 15 bytes

8 4D₆Wk632ƈ∑ẇ\-j

Try it Online!

Explained

8 4D₆Wk632ƈ∑ẇ\-j­⁡​‎‎⁡⁠⁡‏⁠‎⁡⁠⁢‏⁠‎⁡⁠⁣‏⁠‎⁡⁠⁤‏⁠‎⁡⁠⁢⁡‏⁠‎⁡⁠⁢⁢‏‏​⁡⁠⁡‌⁢​‎‎⁡⁠⁢⁣‏⁠‎⁡⁠⁢⁤‏⁠‎⁡⁠⁣⁡‏⁠‎⁡⁠⁣⁢‏⁠‎⁡⁠⁣⁣‏⁠‎⁡⁠⁣⁤‏‏​⁡⁠⁡‌⁣​‎‎⁡⁠⁤⁡‏‏​⁡⁠⁡‌⁤​‎‎⁡⁠⁤⁢‏⁠‎⁡⁠⁤⁣‏⁠‎⁡⁠⁤⁤‏‏​⁡⁠⁡‌­
8 4D₆W            # ‎⁡Push the list [8, 4, 4, 4, 64] to the stack
      k632ƈ∑      # ‎⁢Push a string of 32 random hex digits
            ẇ     # ‎⁣Wrap into slices of lengths in the first list. The 64 is used as a value to ensure that the last 12 slice is fully captured.
             \-j  # ‎⁤And join on "-"s
💎

Created with the help of Luminespire.

Lua, 153 bytes

math.randomseed(os.time())a=load"b=({...})[1]return('%0'..b..'x'):format(math.random(0,16^b-1))"print(table.concat({a(8),a(4),a(4),a(4),a(8)..a(4)},"-"))

Try it online!

Chip, 109 + 5 = 114 bytes

Requires flags -wc36, causing +5 bytes

!ZZZZZZZZZZZZZZZZZZZZZZ
,-----.,+vv--^----^---z
?]]]--R\acd
?xx+-)\\b
?x+x-)\\c
?^xx\--\d
`-xx]v~\e
f*`)'`-\g

Try it online!

Generates 4 random bits (the four ?'s) and converts to hex digits:

• 0x0 - 0x9 => 0 - 9
• 0xa - 0xe => b - f
• 0xf => a

...a bit unconventional, but it saved me some bytes at no expense to the distribution of outcomes.

Go, 119 110 bytes

import(."math/rand";."fmt")
func f(){for j:=0;j<32;j++{if j>4&&j<24&&j%4<1{Print("-")}
Printf("%x",Int()%16)}}

Try it online!

• -9 by @The Thonnu

Python 3, 103 bytes

from random import*;print(''.join(hex(randint(2**(i*3),2**(3*i+2)))[2:]+'-'for i in [8,4,4,4,12])[:33])

Try it online!

Is 100% improvable...

Javascript (ES6) - 102 bytes

UUID v4 compliant

A compaction of broofa's solution on Stackoverflow:

"10000000-1000-4000-8000-100000000000".replace(/[018]/g,s=>(s^Math.random()*256&15>>s/4).toString(16))

Perl 5, 43 bytes

Saved 2 bytes thanks to @Xcali!

printf"%04x"."-"x/[2-5]/,rand 2**16for 1..8

Try it online!

JavaScript (ES6), 79 bytes

a=>[8,4,4,4,12].map(g=e=>e?(16*Math.random()|0).toString(16)+g(e-1):"").join`-`

Python 3.8 (pre-release), 31 bytes

import uuid;print(uuid.uuid4())

Try it online!

Python has an inbuilt package for this specific task. Enjoy :P

Java with Ten Foot Laser Pole v. 1.06, 126 bytes

String u(){return sj224.tflp.util.StringUtil.replace("aa-a-a-a-aaa","a",s->String.format("%04x",(int)(Math.random()*65536)));}

Tested with version 1.06 of the library, but this should work with any version 1.04 or newer.

Pushy, 34 bytes

12N4448s$:Z15U&T)?39+;48+'.;L?45'.

Try it online!

12                                 \ Push 12 to stack
  N                                \ Remove printing delimiter (normally a newline)
   4448s                           \ Push 4448, then split into digits
                                   \ The stack is now [12, 4, 4, 4, 8]
        $                          \ While items left on stack:
         :                         \ (top item) times do:
          Z15U                     \    Push random(0, 15)
              &T)?                 \    If bigger than 10 (a hex digit):
                  39+;             \      Add 39 (offset from ASCII numbers to lowercase)
                      48+          \   Add 48, converting it into the correct character
                         '.        \   Print and pop this character
                           ;L?45'. \ Print a dash ('-'), unless stack is now empty.

MBASIC, 92 bytes

1 FOR I=1 TO 32:PRINT HEX$(INT(RND*16));:IF I=8 OR I=12 OR I=16 OR I=20 THEN PRINT"-";
2 NEXT

Generates 32 "random" hex digits, adding a hyphen in the appropriate places.

Output:

D36A49D6-85AC-51DC-6D84-3BB1EB1A0816

Pyth, 34 bytes

VS32 aYO16)s.e?}km*d4r2 6+\-bb.HMY

Try it online!

trying to generate the indexes of where the "-" should go, and doing the replacement in a smaller way than hardcoding was an interesting challenge, and probably the hardest part.

Explanation

VS32 aYO16)                          // for N in range(32), append a random number 0-15 to the list Y
                              .HMY   // convert each number in Y to its Hex equivalent
                 m*d4r2 6            // make an array (of indexes) containing [8 12 16 20]. *4 mapped over (range(2,6) -> [2,3,4,5])
            .e                       // enumerating map on the random hex list. For each digit, index is k and value is b.
              ?}k        +\-bb       // map onto each digit the ternary question "is index k in the array of idexes?"
                                     // if no, replace with b (the value that was already there), if yes replace it with "-b".
           s                         // "".join( ) to make the list into a string

C (gcc), 143 110 103 96 94 bytes

Golfed down to 94 bytes thanks to ceilingcat and Jonathan Frech.

(*P)()="\xf\x31À";*z=L"\10\4\4\4\14";main(n){for(;*z;*++z&&putchar(45))for(n=*z;n--;printf("%x",P()&15));}

Try it online!

Explanation:

/*
  P is a pointer to a function.
  The string literal contains actual machine code of the function:

  0F 31     rdtsc
  C3        ret

  0xc3 is the first byte of the UTF-8 representation of the character À
*/
(*P)() = "\xf\61À";

// encode uuid chunk lengths as literal characters
// we use wide characters with 'L' prefix because
// sizeof(wchar_t)==sizeof(int) for 64-bit gcc C on TIO
// so z is actually a zero-terminated string of ints
*z = L"\8\4\4\4\14"

main (n)
{
    for (
        ; 

        // loop until we reach the trailing zero
        *z;

        // increase the pointer and dereference it
        *++z 
             // and output a hyphen, if the pointer does not point at zero
             && putchar(45) 
    )
        // output a random hex string with length pointed at by z
        for (n = *z; n--; printf ("%x", P()&15));
}

Octave, 106 105 103 99 96 bytes

function[]=f,g=@(l)[48:57,'a':'f'](randi(16,[1 l]));strjoin({g(8),g(4),g(4),g(4),g(12)},'-'),end

Try it Online

C (gcc),  94   91  86 bytes

main(i){srand(&i);i=803912;for(;i--%16||(i/=16)&&printf("-");printf("%x",rand()%16));}

Try it online!

I would have liked to suggest this version in a comment to Max Yekhlakov (his answer), but unfortunately I do not have the 50 needed reputation points yet, so here is my answer.

803912 is C4448 in hexadecimal, it describes how the output should be formatted (12-4-4-4-8), it is reversed because least significant digits will be read first.
 

Edits:

• saved 3 bytes thanks to Jonathan Frech
• saved 5 more bytes by replacing srand(time(0)) with srand(&i)

Forth (gforth), 91 89 bytes

include random.fs
hex
: f 0 4 4 4 8 20 0 do dup i = if + ." -" then 10 random 1 .r loop ;

Try it online!

Explanation

Changes the base to hexadecimal, then outputs numbers/segments of the appropriate length with dashes at specified intervals

Code Explanation

include random.fs          \ include the random module
hex                        \ set the base to hexadecimal
: f                        \ start a new word definition
  0 4 4 4 8                \ enter the intervals to place dashes
  20 0 do                  \ start a counted loop from 0 to 0x20 (32 in decimal)
    dup i =                \ check if we are on a character that needs a dash
    if                     \ if we are
      +                    \ calculate the next character that gets a dash
      ." -"                \ output a dash
    then                   \ end the if block
    f random               \ get a random number between 0x0 and 0xf
    1 .r                   \ output it right-aligned in 1-character space
  loop                     \ end the loop
;                          \ end the word definition

JavaScript REPL, 79 bytes

'66-6-6-6-666'.replace(/6/g,_=>(Math.random().toString(16)+'00000').slice(2,6))

Try it online!

Math.random may return 0. Adding 5 zeros make the slicing get 4 0s

Java, 192 181 bytes

interface T{static int t(){return (int)(Math.random()*65536);}static void main(String[]a){System.out.printf("aa-a-a-a-aaa".replaceAll("a","%04x"),t(),t(),t(),t(),t(),t(),t(),t());}}

JavaScript, ES6, 106 bytes

"8-4-4-4-12".replace(/\d+/g, m => {t=0;for(i=0; i<m; i++) {t+=(Math.random()*16|0).toString(16)}return t})

Uses Regex replace. Treats the format string as a count for generating a hex char. Hoisting wherever I can; omitting semicolons where possible.

Bash, 67 bytes

for l in 4 2 2 2 6;{ o+=`xxd -p -l$l</dev/random`-;}
echo ${o::-1}

Japt, 32 bytes

[8,4,4,4,12]m@MqG**X sG ù0X} q"-

Try it online!

Ruby, 51 47 + 14 = 65 61 bytes

Run with ruby -rsecurerandom (+14 bytes)

[8,4,4,4,12].map{|n|SecureRandom.hex n}.join ?-

Returns output

Befunge-93, 97 bytes

v>4448v,+<    <
0*    :  >59*0^
62v0-1_$:|>*6+^
>^>41v < @^99<
v<*2\_$:54+` |
?0>+\1-^ v*68<>
>1^

Try it online!

I'm sure this can be shrunk, but this is my first try :)

C++, 194 193 221 210 201 bytes

+7 bytes thanks to Zacharý ( detected a - that should not be at the end )

#include<iostream>
#include<random>
#include<ctime>
#define L(a)for(int i=0;i<a;++i)std::cout<<"0123456789abcdef"[rand()%16];
#define P(a)printf("-");L(a)
void t(){srand(time(0));L(8)P(4)P(4)P(4)P(12)}

If someone has a way to get a different value every execution without changing srand and without including <ctime>, that would be great

R, 63 bytes

x=sample(c(0:9,letters[1:6]),36,1);x[0:3*5+9]='-';cat(x,sep='')

Try it online!

The code first builds a 36 character random string, and then places the four hyphens. It outputs a UUID to stdout.

APL (Dyalog Unicode), 115 78 bytes

a←⊣,'-',⊢
H←⊃∘(⎕D,819⌶⎕A)¨16∘⊥⍣¯1
(H 8?16)a(H 4?16)a(H 4?16)a(H 4?16)a H 12?16

Try it online!

This is my first APL submission. Huge thanks to @Adám for bearing with me at the PPCG's APL chat and for the hexadecimal conversion function.

Thanks to @Zacharý for 1 byte

Edited to fix byte count.

J, 42 39 37 27 bytes

echo'-'(8+5*i.4)},hfd?36#16

Try it online!

SmileBASIC, 65 62 bytes

DEF G H?"-";:END
DEF H?HEX$(RND(65536),4);
END H G G G G H H H

I created a function to print 4 random hex digits: DEF H?HEX$(RND(65536),4);:END as well as 4 digits with a - after them: DEF G:H?"-";:END. Then it just has to call these functions a bunch of times.

Jelly, 17 bytes

ØhWẋ36X€”-“µÇŒð‘¦

Try it online!

Kotlin, 175 bytes

fun main(a:Array<String>){
fun f()="0123456789abcdef".get((Math.random()*16).toInt())
var s=""
for(i in listOf(8,4,4,4,12)){
for(j in 1..i)
s+=f()
if(i!=12)s+="-"}
println(s)}

Try it online!

My first ever Kotlin program & PPCG submission

Perl, 51 bytes

say"xx-x-x-x-xxx"=~s/x/sprintf"%04x",rand 65536/reg

Requires perl5 >= 5.10 I think. For the /r modifier and for say().

Perl 6, 53 bytes

The obvious one:

say join '-',(0..9,'a'..'f').flat.roll(32).rotor(8,4,4,4,12)».join # 67

Translating the Perl 5 example using printf, results in code that is a bit shorter.

printf ($_='%04x')~"$_-"x 4~$_ x 3,(0..^4⁸).roll(8) # 53

MATLAB/Octave , 95 bytes

a='-';b=strcat(dec2hex(randi(16,32,1)-1)');[b(1:8) a b(9:12) a b(13:16) a b(17:20) a b(21:32)]

CJam, 26 25 bytes

8 4__C]{{Gmr"%x"e%}*'-}/;

Try it online in the CJam interpreter.

How it works

8 4__C]{              }/   For each I in [8 4 4 4 12]:
        {         }*         Do I times:
         Gmr                   Pseudo-randomly select an integer between 0 and 15.
            "%x"e%             Apply hexadecimal string formatting.
                    '-       Push a hyphen-minus.
                        ;  Discard the last hyphen-minus.

K5, 35 bytes

"-"/(0,8+4*!4)_32?`c$(48+!10),65+!6

To generate a hex alphabet I generate a character string (`c$) from a list of digits (48+!10) and the first 6 capital letters (65+!6). An alternate way of generating the digits which is the same length is ,/$!10.

With the string "0123456789ABCDEF" generated, the rest is simple. Select 32 random values from this set (32?), slice (_) the resulting string at 0 8 12 16 20 computed via (0,8+4*!4), and then join the resulting string fragments with dashes ("-"/).

In action:

  "-"/(0,8+4*!4)_32?`c$(48+!10),65+!6
"9550E114-A8DA-9533-1B67-5E1857F355E1"

Python 2, 86 84 bytes

from random import*;print'-'.join('%%0%ix'%i%randint(0,16**i-1)for i in[8,4,4,4,12])

This chains string formatters to make Python format the hex numbers uniquely for each segment.

Ungolfed:

import random

final = []
for i in [8, 4, 4, 4, 12]:               # Iterate through every segment
    max = (16 ** i) - 1                  # This is the largest number that can be
                                         # represented in i hex digits
    number = random.randint(0, max)      # Choose our random segment
    format_string = '%0' + str(i) + 'x'  # Build a format string to pad it with zeroes
    final.append(format_string % number) # Add it to the list

print '-'.join(final)                    # Join every segment with a hyphen and print

This could use some improvement, but I'm proud.

gawk, 86

BEGIN{for(srand();j++<32;printf(j~"^9|13|17|21"?"-":E)"%c",x+(x>10?87:48))x=rand()*16}

You can use this once every second to generate a unique random "UUID". This is because srand() uses the system time in seconds since epoch as argument if there is no argument given.

for n in `seq 100` do awk 'BEGIN{for(srand();j++<32;printf(j~"^9|13|17|21"?"-":E)"%c",x+(x>10?87:48))x=rand()*16}'; sleep 1; done

I think the awk part is rather elegant.

BEGIN{
    srand()
    for(;j++<32;) {
        x=rand()*16
        x+=(x>10?87:48)
        printf "%c", x
        if(j~"^8|12|16|20")printf "-"
    }
}

If you want to use it more often than once every second you can call it in bash like this. Note that the awk part is changed too.

echo `awk 'BEGIN{for(srand('$RANDOM');j++<32;printf(j~"^9|13|17|21"?"-":E)"%c",x+(x>10?87:48))x=rand()*16}'`

The echo is added there to print a new line every time.

PowerShell, 77 69 67 bytes

((8,4,4,4,12)|%{((1..$_)|%{'{0:X}'-f(random(16))})-Join""})-Join"-"

edit: extraneous parens:

((8,4,4,4,12)|%{((1..$_)|%{('{0:X}'-f(random(16)))})-Join""})-Join"-"

edit: was able to remove the trailing .Trim("-") from the original:

(((8,4,4,4,12)|%{((1..$_)|%{('{0:X}'-f(random(16)))})+"-"})-Join"").Trim("-")

It may be clearer with some whitespace given the nature of the flags (-f and -Join). I would still like to lose the final Trim("-"):

(((8,4,4,4,12)|%{((1..$_)|%{('{0:X}' -f (random(16)))}) + "-"}) -Join "").Trim("-")

Or, using the built-in functionality (ala the C# answer above)

'{0}'-f[System.Guid]::NewGuid()

However, it seems a wee bit shortcut-y even if it comes in at 31 bytes.

PHP, 69 72 75 bytes

foreach([8,4,4,4,12]as$c)$r[]=rand(".1e$c","1e$c");echo join('-',$r);

This does not output hex digits (a, ... f). They are allowed, but not required by the question body.

No digit group starts with 0 (also not required).

edit: saved 3 bytes thanks to @IsmaelMiguel

Julia, 80 bytes

h=hex(rand(Uint128),32)
print(h[1:8]"-"h[9:12]"-"h[13:16]"-"h[17:20]"-"h[21:32])

Generate a random 128-bit integer, get its hexidecimal representation as a string padded to 32 digits, and divide that into segments joined with dashes.

Thanks to ConfusedMr_C and kvill for their help!

Pyth, 20 bytes

j\-msm.HO16*4hdj83 3

Demonstration.

Encodes [1, 0, 0, 0, 2] as 83 in base 3, then adds one and multiplies by four to get the length of each segment. Then makes hex digits and joins on hyphens.

C#, 65 Bytes

using System;class C{void Main(){Console.Write(Guid.NewGuid());}}

edit: Yes ! C# is shorter than another Language (besides Java) :)