@ihor, it has always been ProgramData

yep, but in osquery 3.4.0 Release Notes that described as one of the changes it brings: "#5568 CVE-2019-3567 - osquery is now installed to Program Files to prevent a privilege escalation vulnerability"