Internal message call CALL opcode

Question

I am trying to make sense of a contacts internal messaging. The contract is sending 6.6 ether to the address that invoked the contract. From what I understand, the CALL opcode carries out a transaction of ether. I have read that the CALL opcode has the operand order: gas, to, value, in offset, in size, out offset, out size. I know that this particular transaction was for the amount 6.6 ether, as seen on etherscan. Must the operands be in particular regristers? Can I gain this information from the "stack" or "memory" fields in the snippet. I gained this using debug_traceTransaction

How does etherscan get this information?

 {
depth: 1,
error: null,
gas: 24347,
gasCost: 85353,
memory: ["000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000000000000000000102", "0000000000000000000000000000000000000000000000000000000000000060", "000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000005b97e9081d940000", "000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000000000000000000080", "0000000000000000000000000000000000000000000000000000000000000000"],
op: "CALL",
pc: 3215,
stack: ["00000000000000000000000000000000000000000000000000000000b61d27f6", "00000000000000000000000000000000000000000000000000000000000002f1", "000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000005b97e9081d940000", "0000000000000000000000000000000000000000000000000000000000000084", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000000", "000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000005b97e9081d940000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000000000000000000000", "0000000000000000000000000000000000000000000000000000000000000060", "0000000000000000000000000000000000000000000000005b97e9081d940000", "000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e", "0000000000000000000000000000000000000000000000000000000000012785"],
storage: {
  0000000000000000000000000000000000000000000000000000000000000106: "0000000000000000000000000000000000000000000000005b97e9081d940000",
  0000000000000000000000000000000000000000000000000000000000000107: "00000000000000000000000000000000000000000000000000000000000043a3"
}

Answer 1

CALL operands are located in stack data, in reverse order.

The last item in the list provided by debug_traceTransaction is gas.

The second from the end is address:

000000000000000000000000b0d3e9f50b3985d58df44600071047ee17ecb42e

The third item from the end is transaction value (in hexadecimal):

0000000000000000000000000000000000000000000000005b97e9081d940000

Note that calls to precompiled contracts such as ecrecover also appear as CALL in trace. They could be identified by "to" address.