Your mistake is that you counted the number of passwords where the first character is upper case, the second character is a number, and your remaining two characters are anything. You neglected to count the password "3aBc" as well as neglected to count the password "133T" etc...
For a correct solution, apply inclusion-exclusion. There are $95^4$ total passwords. $(95-26)^4$ of which contain no capital letters so we remove those from the count. $(95-10)^4$ of which contain no numbers so we remove those too, but in doing so the passwords with neither got removed twice so we correct it by adding that amount back in.
In more detail, let $\Omega$ be the set of passwords of length $4$ using these $96$ characters with no other restrictions. Let $A$ be the set of passwords with no capital letters. Let $B$ be the set of passwords with no numbers.
We are tasked with counting $|A^c\cap B^c|$, i.e. the set of passwords where there is at least one capital letter and there is at least one number.
By demorgan's, $A^c\cap B^c = (A\cup B)^c = \Omega\setminus(A\cup B)$
We have then by inclusion-exclusion $$|A^c\cap B^c|=|\Omega\setminus(A\cup B)|=|\Omega|-|A|-|B|+|A\cap B|$$
We find $|\Omega|=95^4$, $|A|=(95-26)^4$, $|B|=(95-10)^4$, and $|A\cap B|=(95-26-10)^4$ each by straightforward application of multiplication principle.
The final total is then