Here I posted my findings by sniffing my TH2822A. By looking at your EEPROM dump I noticed that the data accessed by my meter when going into 10kHz mode are empty in yours, they are:
Switching Frequency from 1k to 10k:
Read @0x0326: A5 5A
Read @0x0328: 3A 9D BF 49 9C 23 3A CB
Read @0x073A: A5 5A
Read @0x073C: C8 9A 21 3D 02 39 35 3C
Read @0x0B26: A5 5A
Read @0x0B28: 03 AB 7E 3F 8E 2B 33 3D
In your EEPROM they appear empty, I'm not so sure about what does that data is, but I think it may be calibration data because in that other forum topic, reagle's (user) meter sniffing threw out different data in those same adresses. If this is not calibration data it could be some encrypted code, the funny thing is that for each frecuency selection the meter reads a new set of data, please read my entire post on the other topic.
I do not have a unviersal programmer, but I got a bus pirate, just need to learn how to use it to make a backup of my eeprom and start playing around.
But by now you could try changing the address 0x0054 to the value 0x0B (instead of 0x07 as it is in your memory dump) which means to power-up in 10kHz mode, this might not work because this is just the power-up frecuency value, there might be other bits to flip in order to make it possible, but it would be a nice try, if possible, reading the probes with an oscilloscope would confirm if it's generating 10kHz.
From address 0x0052 to 0x0063 there's the power-up data and this are my updated findings:
Write @0x0052: 01 (Mode, 00: L, 01: C, 02: R, 03: Z)
Write @0x0053: 0E (Sec. Display, 11: Frequency, 0E: ESR, etc. )
Write @0x0054: 0B (Frecuency, 0B: 10kHz, 07: 1kHz, 03: 120Hz, 02: 100Hz)
Write @0x0055: 00
Write @0x0056: 00
Write @0x0057: 00
Write @0x0058: 00
Write @0x0059: 00
Write @0x005A: 00
Write @0x005B: 00
Write @0x005C: 00 (??, 00: L, 01: CRZ)
Write @0x005D: 00
Write @0x005E: 00
Write @0x005F: 00
Write @0x0060: 00
Write @0x0061: 00
Write @0x0062: 00 (Rate, 00: slow, 01, fast)
Write @0x0063: 00 (01: AUTO, 00: otherwise)
I can tell your meter powers-up in AUTO mode, starting in capacitance measurement (this is normal because the leads are usually open reading some pF of capacitance), showing on the secondary display the ESR, in 1kHz frequency and in FAST update rate.
Nothing different between your 1kHz meter and my 10kHz meter so far. They could be different firmwares, or the presumable calibration data is not really that, but some encrypted code which tells the MCU which version it is, or maybe even both. But if this is true, the encryption key would be different for each meter, as we 3 (reagle, you and me) got different data for the 100Hz, 120Hz and 1kHz ranges.