Unexpected results using cryptoJS hmacMD5

Question

I have set up some encryption using cryptoJS library like so:

Adding more code following comments

Here is the script in full, I'll ask our vendor to provide a new secret

<script src="https://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-md5.js"></script>

<script>

var now = new Date().getTime();
var aid = 1941816;
var sid = {{trialpay cookie values}}.sid;
var user = {{user id}};
var query_string = '?tp_aid=' + aid + '&tp_sid=' + sid + '&tp_t=' + now;
// query_string var during instance in question was this = '?tp_aid=1941816&tp_sid=U1281574706&tp_oid=103060921&tp_t=1435078629604'; 

// hash md5
var key = '8b2b7d7dc4063bc0bf30986536f8816c71405c16fb0cc4677db1e349af157baa';
var hash = CryptoJS.HmacMD5(query_string, key);
hash = hash.toString();

//passback
var tp_img = document.createElement('img');
tp_img.height=1;
tp_img.width = 1;

//tp_img.src = "https://tpc.trialpay.com/" + query_string +  "&tp_v1=" + hash;


tp_img.src = "https://tpc.trialpay.com/?tp_aid=" +  aid +
                           "&tp_sid=" + sid +
                           "&tp_oid=" + encodeURIComponent(user) +
                           "&tp_t=" + now + 
                           "&tp_v1=" + hash;

document.body.appendChild(tp_img);

</script>

During the instance of testing in question, I know that the var being hashed, query_string, was this value:

?tp_aid=1941816&tp_sid=U1281574706&tp_oid=103060921&tp_t=1435078629604

The output that our vendor received was this value:

727a9075e3c8e7a7758e3f6a0369a476

They told me that they expected this value:

60eadcb01f3f04a3d7169a1dd0199943

When I check the output in my own environment using console.log(), I get the expected value. So I don't know how they got the value ending in 476.

This is all that I know. Any help would be much appreciated. Let me know if there is any other info I can provide on this.