Is the f2 surrounded by asterisks?
Without asterisks:
00 00 00 [a-f0-9]+ (?<hexits>[a-f0-9]+).+78
With asterisks:
\*(?<hexits>[a-f0-9]+)\*
from User warren – Stack Overflow https://stackoverflow.com/questions/75315320/regex-to-match-part-of-a-hex/75315348#75315348
via IFTTT