quuid: GUID triage that actually closes loops

Date: February 02, 2026

Parse, resolve, enumerate, and pivot in one CLI. quuid is built for COM-heavy investigations where GUIDs are everywhere.

Quick Parse for Pipelines

_test\quuid.exe parse 6F9619FF-8B86-D011-B42D-00C04FC964FF --one-line

{6F9619FF-8B86-D011-B42D-00C04FC964FF}

Use this mode when you need normalization before joins, dedupe, or registry lookup workflows.

Workflow 1: Resolve COM Meaning in Both Registry Views

_test\quuid.exe find "{00021401-0000-0000-C000-000000000046}" --both-views

{00021401-0000-0000-C000-000000000046}
  [CLSID:64] Shortcut
    InprocServer32     C:\Windows\System32\windows.storage.dll
  [CLSID:32] Shortcut
    InprocServer32     C:\Windows\SysWOW64\windows.storage.dll

This immediately answers 64/32 registration divergence questions that waste hours in mixed-bitness environments.

Workflow 2: Inventory the Namespace

_test\quuid.exe enum clsid --limit 5 --with-name

[CLSID] CLSID  {0000031A-0000-0000-C000-000000000046}
[CLSID] {0000002F-0000-0000-C000-000000000046}  CLSID_RecordInfo
[CLSID] {00000300-0000-0000-C000-000000000046}  StdOleLink
[CLSID] {00000301-A8F2-4877-BA0A-FD2B6645FB94}  PSFactoryBuffer

Great for environment baselining, COM footprint reporting, and forensic pivots from suspicious GUIDs.

Guardrails

Binary scanning modes intentionally trade precision for recall. Keep --registry and view flags in the loop so noisy matches become actionable ones.